Claude Opus 4.8
30891f99cf
All checks were successful
CD / Build and push images (push) Successful in 4m2s
CI / Lint, typecheck, test (push) Successful in 2m46s
CI / Auth e2e pack (push) Successful in 3m45s
CI / Build container images (push) Has been skipped
CD / Deploy to Test (push) Successful in 8s
CD / Smoke tests against Test (push) Successful in 1m18s
CD / Promote to Int (push) Successful in 12s
Extend uploads (#27, ADR 0011) beyond images to a configurable general attachment allowlist, plus the page attachments section and the Pond Admin file manager. Backend: - Two instance settings: `upload.allowedExtensions` (lowercase, dot-stripped, images always allowed regardless) and `upload.svgPolicy` (reject | sanitize). - FilesService.resolveUpload: raster images still decided by magic bytes; SVG is sanitized with DOMPurify (scripts, event handlers, foreignObject stripped) or rejected per policy; everything else is admitted only if its extension is on the allowlist. A sanitized SVG's stored bytes are re-accounted so pond_usage matches disk. - Downloads set `Content-Disposition: attachment` for every non-raster type (office files, PDFs, SVG) with `nosniff`, so they can never execute inline; raster images stay inline for page embeds. - New endpoints: `GET /ponds/:id/files` (pond_admin: all files + usage + orphan flag), `POST /pages/:id/files` and `GET /pages/:id/files` (page-write/read: the attachments section). New error code `upload_type_not_allowed` (de+en). Frontend: - Page attachments section (AttachmentsPanel): upload, list with type glyph, size, and uploader, insert-as-link into the document (an internal media link that downloads, never renders inline), and delete. Toggled in the editor. - Pond file manager (PondFileManager) in pond settings for Pond Admins: every file with its referencing page (or an orphan flag) and storage usage. - Admin uploads settings form (allowlist + SVG policy). New `files` i18n namespace (de+en). Tests: - files.e2e.db.test.ts: allowlisted non-image accepted and served as a download; disallowed extension rejected; renamed-.html-as-.png still fails; SVG sanitized (scripts/handlers stripped) and reject-mode rejects; page attachment listing; pond file manager usage/orphan; non-admin denied. - New e2e pack apps/web/e2e/attachments.spec.ts (+ CI step): upload → list → insert link (verified attachment disposition + nosniff), disallowed-type error, pond file manager usage/orphan. Local: typecheck, lint, i18n:check, build all green; api-db 184, shared 121, web 50; attachments pack 3/3, members 3/3, content 5/5. Adds dompurify + jsdom to the api for server-side SVG sanitization. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01EwZ4jR4KFAPvpjWevfUGX1
53 lines
1.8 KiB
TypeScript
53 lines
1.8 KiB
TypeScript
import type { AttachmentMimeType } from '@dorfteich/shared';
|
|
|
|
/**
|
|
* Magic-byte signatures for the raster-image allowlist (ADR 0011). The
|
|
* client-declared MIME type and filename extension are never trusted —
|
|
* only the actual bytes decide, which is what catches a renamed
|
|
* `.html`-as-`.png` upload.
|
|
*/
|
|
const SIGNATURES: ReadonlyArray<{
|
|
mimeType: AttachmentMimeType;
|
|
matches: (buf: Buffer) => boolean;
|
|
}> = [
|
|
{
|
|
mimeType: 'image/png',
|
|
matches: (buf) =>
|
|
buf.length >= 8 &&
|
|
buf.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])),
|
|
},
|
|
{
|
|
mimeType: 'image/jpeg',
|
|
matches: (buf) => buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff,
|
|
},
|
|
{
|
|
mimeType: 'image/gif',
|
|
matches: (buf) =>
|
|
buf.length >= 6 &&
|
|
(buf.toString('ascii', 0, 6) === 'GIF87a' || buf.toString('ascii', 0, 6) === 'GIF89a'),
|
|
},
|
|
{
|
|
mimeType: 'image/webp',
|
|
matches: (buf) =>
|
|
buf.length >= 12 &&
|
|
buf.toString('ascii', 0, 4) === 'RIFF' &&
|
|
buf.toString('ascii', 8, 12) === 'WEBP',
|
|
},
|
|
];
|
|
|
|
/** Returns the sniffed raster-image MIME type, or null when the bytes match none of the allowed signatures. */
|
|
export function sniffImageMimeType(buffer: Buffer): AttachmentMimeType | null {
|
|
return SIGNATURES.find((signature) => signature.matches(buffer))?.mimeType ?? null;
|
|
}
|
|
|
|
/**
|
|
* Heuristic SVG detection: an XML document whose leading bytes contain an
|
|
* `<svg` tag. SVG has no binary magic number (it is XML), so we scan the
|
|
* head, tolerating a BOM, an XML prolog, and a leading DOCTYPE/comment. This
|
|
* only gates *candidacy*; the bytes are still sanitized or rejected per the
|
|
* SVG policy before storage, so a false positive is harmless.
|
|
*/
|
|
export function looksLikeSvg(buffer: Buffer): boolean {
|
|
return buffer.subarray(0, 1024).toString('utf8').toLowerCase().includes('<svg');
|
|
}
|